Read the docs
TI-2026-76420 Aliases CVE-2026-109431GHSA-9vfr-59xg-h3vg

Missing authorization in Camunda task comments and attachments

Priority HIGH 72CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Camunda 7 from 7.24.0 before 7.24.14 and from 7.23.0 before 7.23.17 is affected. A missing authorization check in the engine-rest task sub-resources (CWE-862) lets an authenticated attacker with no permission grants read or delete task comments and attachments using only a known object ID. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints. Using only a known object ID, attackers can exploit TaskAttachmentResourceImpl and TaskCommentResourceImpl methods such as getAttachment, getAttachmentData, deleteAttachment, and getComment to read or download task attachments and comments and to permanently delete task attachments.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00359 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Camunda 7 (Camunda): 7.24.14, 7.23.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CamundaCamunda 77.24.0 to before 7.24.14; 7.23.0 to before 7.23.177.24.14, 7.23.17Patch availableCNA
  • Camunda 7 VendorCamunda Affected 7.24.0 to before 7.24.14; 7.23.0 to before 7.23.17 Fixed in 7.24.14, 7.23.17 Patch available CNA

Remediation

Camunda 7 is fixed in versions 7.24.14 and 7.23.17.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Camunda 7 (Camunda) Fixed in 7.24.14, 7.23.17

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Camunda 7 7.23.17, 7.24.14

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-76421 Expression injection in Camunda 7 orQueries enables command executionPriority HIGH 81
    Show all 2 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-109431
  2. 2026-10-19 CISA SSVC decision points changed
  3. 2026-10-19 Priority changed: MEDIUM → HIGH
  4. 2026-10-20 Alias added: GHSA-9vfr-59xg-h3vg

References

Exploit 1

Patch 1

  • TI-2026-76421 Expression injection in Camunda 7 orQueries enables command execution CVSS 4.0CRITICAL 9.3
  • TI-2026-68026 Incorrect authorization in Camunda 7 setup lets attackers add admins CVSS 4.0CRITICAL 9.2
  • TI-2026-76422 Broken access control in Camunda Cockpit exposes process data CVSS 4.0MEDIUM 6.0
  • TI-2021-09385 Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. CVSS 3.1CRITICAL 9.1
  • TI-2021-06144 Prototype pollution in min-dash CVSS 3.1HIGH 7.5
  • TI-2024-34492 WordPress bpmn.io plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences